Lecture 12 Page 1 CS 236 Online Virtual Private Networks VPNs What if your company has more than one office? And they’re far apart? –Like on opposite coasts of the US How can you have secure cooperation between them?

Lecture 12 Page 2 CS 236 Online Leased Line Solutions Lease private lines from some telephone company The phone company ensures that your lines cannot be tapped –To the extent you trust in phone company security Can be expensive and limiting

Lecture 12 Page 3 CS 236 Online Another Solution Communicate via the Internet –Getting full connectivity, bandwidth, reliability, etc. –At a lower price, too But how do you keep the traffic secure? Encrypt everything!

Lecture 12 Page 4 CS 236 Online Encryption and Virtual Private Networks Use encryption to convert a shared line to a private line Set up a firewall at each installation’s network Set up shared encryption keys between the firewalls Encrypt all traffic using those keys

Lecture 12 Page 5 CS 236 Online Actual Use of Encryption in VPNs VPNs run over the Internet Internet routers can’t handle fully encrypted packets Obviously, VPN packets aren’t entirely encrypted They are encrypted in a tunnel mode

Lecture 12 Page 6 CS 236 Online Is This Solution Feasible? A VPN can be half the cost of leased lines (or less) And give the owner more direct control over the line’s security Ease of use improving –Often based on IPsec

Lecture 12 Page 7 CS 236 Online Key Management and VPNs All security of the VPN relies on key secrecy How do you communicate the key? –In early implementations, manually –Modern VPNs use IKE or proprietary key servers How often do you change the key? –IKE allows frequent changes

Lecture 12 Page 8 CS 236 Online VPNs and Firewalls VPN encryption is typically done between firewall machines –VPN often integrated into firewall product Do I need the firewall for anything else? Probably, since I still need to allow non-VPN traffic in and out Need firewall “inside” VPN –Since VPN traffic encrypted –Including stuff like IP addresses and ports –“Inside” means “later in same box” usually

Lecture 12 Page 9 CS 236 Online VPNs and Portable Computing Increasingly, workers connect to offices remotely –While on travel –Or when working from home VPNs offer secure solution Usually possible to pre-configure portables to have VPN software

Lecture 12 Page 10 CS 236 Online VPN Deployment Issues Desirable not to have to pre-deploy VPN software –Clients get access from any machine Possible by using downloaded code –Connect to server, download VPN applet, away you go –Often done via web browser –Leveraging existing SSL code –Authentication via user ID/password Issue of compromised user machine

Lecture 12 Page 11 CS 236 Online VPN Products VPNs are big business Many products are available Some for basic VPN service Some for specialized use –Such as networked meetings –Or providing remote system administration and debugging

Lecture 12 Page 12 CS 236 Online Juniper Secure Access 700 A hardware VPN Uses SSL Accessible via web browser –Which avoids some pre-deployment costs –Downloads code using browser extensibility Does various security checks on client machine before allowing access

Lecture 12 Page 13 CS 236 Online Citrix GoToMeeting Service provided through Citrix web servers Connects many meeting participants via a custom VPN –Care taken that Citrix doesn’t have VPN key Basic interface through web browser

Lecture 12 Page 14 CS 236 Online Honeypots and Honeynets A honeypot is a machine set up to attract attackers Classic use is to learn more about attackers Ongoing research on using honeypots as part of a system’s defenses

Lecture 12 Page 15 CS 236 Online Setting Up A Honeypot Usually a machine dedicated to this purpose Probably easier to find and compromise than your real machines But has lots of software watching what’s happening on it Providing early warning of attacks

Lecture 12 Page 16 CS 236 Online What Have Honeypots Been Used For? To study attackers’ common practices There are lengthy traces of what attackers do when they compromise a honeypot machine Not clear these traces actually provided much we didn’t already know

Lecture 12 Page 17 CS 236 Online Can a Honeypot Contribute to Defense? Perhaps can serve as an early warning system –Assuming that attacker hits the honeypot first –And that you know it’s happened If you can detect it’s happened there, why not everywhere?

Lecture 12 Page 18 CS 236 Online Honeynets A collection of honeypots on a single network –Maybe on a single machine with multiple addresses –Perhaps using virtualization techniques Typically, no other machines are on the network Since whole network is phony, all incoming traffic is probably attack traffic

Lecture 12 Page 19 CS 236 Online What Can You Do With Honeynets? Similar things to what can be done with honeypots (at network level) Also good for tracking the spread of worms –Worm code typically knocks on their door repeatedly Main tool for detecting and tracking botnets Has given evidence on prevalence of DDoS attacks –Through backscatter –Based on attacker using IP spoofing

Lecture 12 Page 20 CS 236 Online Backscatter Some attacks are based on massive spoofing of IP addresses –Particularly distributed denial of service attacks Packets are typically reasonably well formed If target gets them, it will reply to them This can be helpful

Lecture 12 Page 21 CS 236 Online Backscatter In Action FAKE! What does the target do with this packet? It probably sends a reply To the forged address! What if this machine is a honeypot?

Lecture 12 Page 22 CS 236 Online So What? The honeypot knows it didn’t ask for this response So it must have resulted from spoofing Which means the source of the packet is under attack With sufficient cleverness, you can figure out a lot more

Lecture 12 Page 23 CS 236 Online What Can Backscatter Tell Us? Who’s being attacked For how long With what sorts of packets Even estimates of the volume of attack

Lecture 12 Page 24 CS 236 Online How Do We Deduce This Stuff? Who’s being attacked –Whoever sends us reply packets For how long –How long do we see their replies? With what sorts of packets –What kind of reply? Even estimates of the volume of attack –This is trickier

Lecture 12 Page 25 CS 236 Online Estimating Attack Volumes Assume the attacker uses random spoofing –He chooses spoofed addresses purely randomly Your honeynet owns some set of addresses –Perhaps 256 of them Your addresses will be spoofed proportionally to all others –Allowing you to calculate how many total packets were sent

Lecture 12 Page 26 CS 236 Online Complicating Factors in This Calculation Not all spoofed packets delivered –It’s a denial of service attack, after all Not all delivered packets responded to Not all responses delivered Attackers don’t always spoof at random

Lecture 12 Page 27 CS 236 Online Do You Need A Honeypot? Not in the same way you need a firewall Only worthwhile if you have a security administrator spending a lot of time watching things Or if your job is keeping up to date on hacker activity More something that someone needs to be doing –Particularly, security experts who care about the overall state of the network world